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o]^H ^ 3^7> ^7}*1 sf^^- ^*l*Rr ^ H o^^l ZL ^ 

^ ^A>tfl^^6fl ^ i^ol 5.^-5) ol oj^l ^^^(static analysis) 

^-2. ^t^Ht* ^^1^ Ss](tree)^2:# °l-g-*fl ^r^Rr ti l^ A o v 

= ^12.1-31-, a o v 7 ) ^A>rfl^-4^ol ov^ ^5]^ #7l Afls 

E^flif #*fl ^S-^Kr #^S5.-&^ 5ffo S ^ 2.= 

£ 1 
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^ 2£7} w7}*l s)-^ ^1 ^ w 0 V^ {Detect ion Apparatus ' and 

Method of Embedded Malicious Code in File} 



<2> £ 2^ ^ xc}€- ^ 5i;EL7> ^7^ 5^ ^1 ty^-B- M-^\E 

<3> <&^£] ^J2. ^-Jl°1] tfltb ^> 

<4> 10. 91^-]^} 101. ^3.^. 

<5> 102. *l^HSzz.3» 103. 

<6> 104. = DB 105. til^HS.^ 

<7> 106. t^l-^H^- 
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<8> it*$-& ^ HS-H^H xl-SJsKr ^(doc, ppt, xls, hwp, wmf 

^ofl^ -^^>^ HS-^^oll tflsfl ti^Aj- -f>~°~i- oVAj =7 = 7}- #7} 

<9> s|e doc-MS Office Word, ppt -MS Office PowerPoint, xls-MS Office Excel, 

hwp-tr#, wmf-MS Windows Media Player^- s.^ ^-^Vl- ESn^ 

o] ^<*$-jr oj-g-^ ^c)] <^2]2\ 3£f Aj^Kr 7}^SL5L 

<10> O) 7 )^^ *VA£ 3 n 7 ^ ^.c^o. oHl<|j ; 0)1/0 7-1, P2P -^0.5. & 

<n> <>1 71^^ MS Office ^5-8: *1 -§-*}■ ^3^- lM*Rr y o v ^S 

-^-vfls.^^ 10-2005-0044241^1 " ej-^ iS=7> ^7^^] ^ b3-x] wj-^ » o] 
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<12> O)^^ ^2fl7l^#^ jL*] ^ ^A] 

<13> Zl&luJ. olE^ ^7|*1 ^^=7> <?lS*3S)<H olj7, nflasf 

<14> #7]& ^Efl 7l#Sl «*>7l ^ ^ ^ nflaL 

Sf^> ^>u|^ 2.^ £Sa^fol 7fA]ol xl^Rr t&4\& *]E]tfRf 

^ #1^* ©l-g-tb tfl-g-^- £U, 7l^ol ^ Dfl ^j 7l^o] o}^ 3^ 

^ ^7> ^1 g ^ H o^^l ^ 
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SL^M 5^*1 ^i^^ (static analysis)^ -f-*fl ^*Hr 
^-fr-r-1- HS^liS] ^(tree)^* °l-g-*fl IMS. 

<16> tb^, i£^ofl 0).=. OV^ S c 7 "|. ^T^^l a o V ^^ ^41^4^1 

4^ i^o] ^7^>^^]# &^}7] ^^^( s tatic analysis)# 

HM^h ^7} ^4, A oM ^AVcfl^-^oH ^ 40^ ^ ^ 

header ^ PE header7> €^1]3t*1 ^ ^-f^lfe #7] ^ Aft^s).^ 
* *flS.£ ^ o}«-^ Ei ^ ^ 2^14, A o V 7l £u|B|^ 
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<17> #7] ^# 3.^.7} ^7^ S%<£ H o V ^ #71 3#3HH #7l ^flS 

£ Wl^# #7l ^Aftfl^Vsj-o^ol q-# Sj-^S. ^ 

<18> 5Etb, #7l 2^7^ #7] ^}tfl#5}-<|]-g- 

2-1^7^1^, #71 *\Q^5LI1^SLS. #7l ^A>tfl^B|.<a^. ^*Kr #7l 
^l^HSZL^^l ^^MH Afl^^- Hi/|A 7 i. Aj#sl^^ 2.u|E^s>^ 2-3^/^11- 

<19> Stt, #7l 3^7)1^, #71 2#7fl<2l S-ME^ ^4, #71 ^€ A}|S.-g- si 

^li^l Jfs. £^11^7} ^l^SSn^s] = HS^l^sl Be) (tree) ^-2: 

# ol-g-*fl ^*Rr 3-1^^4, -*fS. HS.^li7> ^H^ZLBflolTg ^# 2^]A 
DB°fl #71 AJ#^ AflS^; HS-Afl^^o] ol^l 3^*}^ 3-2^7^1^, #71 

# 7 ] ^ DB^l #7l ^#^1 HSAil^ol &SL*£ w]^ 

^ES^liS. ^^Kr 3-33:711-1- 3E#*M °l^p<>|*l*r ^ s^jo S tb4. 

<20> ol^> M^cq =,1=7}. sj.^ #^l(i00)ofl tflSH 2 l-§- 

^S^M #*flS}7ll 
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<21> £ l£r -g- ^ofl ttj-^. 3=7> ^7^ #*1U00)^ ^-g- 

(101), ^HS-H^ ^^S.l-(102), Bl^^-s^li ^12.^(103), ^^SAili 
DBC104), al^^H^ili #*\}&3,2.w (105) ^ ^#3M-*r-(106)-I- SL^tr^r. 

<22> ^^1 nJ-Si^, ^ i2H.7} ^7^ 34 «S #*l(100)fe A>-g-*> olE-1 

*IM^(user interface)(10)» *«fl A>-g-*}3.-?-El ^r^^-^* ^^Jl, ^ 

^fr ^A>cfl^-B). o^o)] ^^7} 5L^S\o] ol^ll- ^A^VJI, 3. ^A> # 

<23> ^l^^-S, ^51 <5|^ ^^7> ^7}^ 34 <g ^ ^1(100)^1 = 

2.^-(101)^- 9l^\n°}^(user inter f ace) (lO)-I- **fl ^}tfi 

-#s)-<|H1 (static analysis)^: ^ S.^9l MZ Header^ PE 

Header7> 5L^-5q°1 5^*1 t^lt^. 

<24> ^54, ^r^^HHl ^ 54^ MZ Header^l- PE Header7> S^- 
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<25> ^Ml^>7fl^ H*$51^ ^12-1- (101)^8: 3*r*HWSH Cflsfl ^SJ 7>^tb 4 

^ ^ pe 4^ -7 ^ pe t?-^^ 14=^ , 

SEtr ^ 7>^*^] DOS MZ header - PE header ^v}*] ^a}*}^ ^ ^ 7}*] S 
^i<Hl ^ ^-f *fl^- tfl*fl sj-^ ^h.7> -y«flol = (embadded)€ 7 A°-S- It*) 

<26> ^7]a^ pe^ Portable Executable(°l ^7>^tr , 

Win32^ 7l^^tl 4«J "Portable Executable" ^ ^n]^ w in32 

*HH ^-§-°-S A>-g-^- ^ «.*j-cf s.^. Win32 ^^(VxDSr 16«lm DLL 

^1^1 PE ^r-§-tr£f. 

<27> *V^! ^^cfl^Sr^^l^i ^ 3.^.7} ^lsl^l ^ Tj-f oil^ ^A>cflA o V2|.^ 

<28> ^l^SSZL^ ^^2.^(102)^- ^A>rfl^s|.^^ SJ-^H ^sKr x)Q 

zz.efl.g- sfl^>^ HJL^li^ ^^^S* <£3^t}. <« 1-^, ^A>rfl 

^■4°^ ^7.>7> doc^Tg ^H^ZL^ ^Afl^o^ nflj ^^01 MS office 
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Word^l ^^sf ^St Hk&\^. 

<29> ^l311-(103)^r ^^sf^ s.q 

sfl^r^l ^ DB(104)» «1 ^tb^. 

oo> <^7H, 2S/|A DB( 104)^1^ H^-ZLejHH ^^-^o.^. £S 

<3i> ^ ^3)-, JfJE. E5^|i7} ^> DB(104HH ^3*1 Afl 

<32> al^AVH^^ ^12.1: (103)^ Hl^^S^^ Win32*lM S.-E- 
23M)^ He) (tree) ^£.3 "fl^l z^S] «-5L(parent) 
ifif ^ (child) £S^liS] ^r?fl» ^-isfl Si^t 
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<33> = 7 o V ^l^-2-l-(105)^r ^r^^r ^ °1 <%s£ & 

q^#^|ol«-(l06)S ^ 

<34> W>Sf oV^ a e 7 J. ^7}^ ^ ( 100) <HH ^ 

i2J=7> ^T^^l S^-g- fi^Hr ^r^SHl « £ 2* ^Ml^>7fl -M^Ch 

<35> 51 2^ 4^ ^ ^7> # oV^ sj-o^^. EJ-*]*Kr 

<36> ^-§-7>ofl o}*fl ^1 ^ = S.ZZ.^°1 Al ^jK201), ^>-§"7> o]E^] i(10)# 

f-*fl ^>-§-7.>7> ^A>cfl^s|-^^- <a^^(202), ^-7]2.1r(101)€r ^3^*1 

(static analysis)* ^f-«fl ^^>tfl^5^^ ifl^-ofl MZ Header 7]- ^*rfe*l ^A>*Vt^- 
(203). 

<37> ^^1-^^(203), ^rtfl^s}-^ iflJf<*fl MZ Header 7> ^7fl*>^ PE Header 7> ^ 

*fl*Rr*l 3*Kh=K204). ^^tflW^ iflJfofl pe Header 71- ^M^, ^A>tfl^ 

^ 3£7f 3^3. ^2(205)*H ^^fl- #^(215)^51, £ H 
#S.tbCr(216). 
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<38> ^^>^^-(203), ^^>tH^s|-^ ifl^-6|) mz Header7f ^fl^M 

^2.^(103)^1^ *)^HSzl*]M1 tfltb 3.^B\^^ 
(207)«H *1^5.ZL*gjLS ^AVcfl^sJ-^^ 43*8^(208). 

<39> ES^li 2.M^ig(207) # A flS^r ££^1^7} ^38^*1 ^<?1 (209)*>J1 , 

^^(209), HS^1^7} ^^S)^ BeKtree)^* °l-g-*> 

^ ^-^=1 Jfa. H.SAfli7> ESIL^S] ^-oi(210)tb 

1=1-. 

<40> ^-^^^-(210), -¥-2- HS^li7> x]^ S^ZL^^l HS^l 

A 3 A 3& A fl5-^ SS^li^ol ^a o v £54/. DB( 104)^1 #*fl*}^*l ^^tb 

4(211). 

<4i> ^^^^-(211), ^S. ^^^l^^ol ^a o v HS^li DB(104)°1] 

*1 "^s^S. ^(212)S}o| yl^^-HS^li ^M]^S2^(105)<^l^i ti]^ 

HS^l^Ol Afl^-g- #*fl#^}ZL(213), ^A>cflA o V5)-<yol OV^ sj-c^ol 

* #^(215)t!: ^ ^ ES^^t ^^-*Vc}(216) . zl^*} <g , ^l^HSZL 



22-14 



1020070038466 



<42> oj-et, ^-^1^^(209), ^l^^S-ZL^ol f fi f nj);^*] Afl5.£ =S^)if ^ 

3^4(211) ^5.^1 i7> ^^o]^ ^^T-sj-^s. 

M-^l ^ ^ *fl4H t^Ml ^^^A]^ ^ olcf. 

<44> ^o V #t> *W ^-ol Mj-t^oll o}^|- ov^ =i£L7|- #7}^ ^ ^ «o V 

* °l-§-^>°i ^l^S^ <^5i=7} 5\-<Q<>)] tflS|H ^^^1^1 
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^AVcflAj-^o^ofl ^ t%<£ S.^S\o] 01^) ^-g^Kstatic 

analysis)^ ^lJE-l-; 

^-5. ^^-o^ £ S ^c] BBKtree)^* °l-§-*i) #i£*Hr 

-#71 ^A>cfl^«^ol ^ S c 7 ]. £- ^7} ^^51^ ^ 

2] 

#7l = ^-71 ^^^--^ (static analysis)^- ^Sfl -#7] ^ 

A>cflA 0 Vs|.^oil ^sj s|.<aj MZ header ^ PE header7> ^^fl^^^l- ^SKr 
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*Rr ^iLJL ^ ^ i2=7> ^7^ S><a ^1 

4] 

l^lit 7 oMl #£.*}^r ^ ^ ^7> #7^ *}<U 

3*1. 
[^^*ch 5] 

(static analysis)^: ^r«S*>^ l^Tll ; 

^7l ^^i]-, a o v 7 ] ^j-tfl^lH ^sj 2)-^ ^ header ^ PE 

header 7} ^*fl*r*l ^ ^AfcflA> 3 ^o^ X }^HS.ZL^* -g«8*H 

Afls^ HSA^li^ aJ^ £Me1^5}^ 2^741; ^ 

^7] EMEU ^"71 cfltr Afl^gr HS.a^)^ 

^ ^ A o v -B-¥-» ^r^r^r 3^r7fl 

« S.^}^ °l^*l^r ^-^^-S SKr ^ ^=7> ^7^ 51- <U 
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6] 

^-71 *j^£-^£r ^-71 ^ftflW'lH ^ s)-<a ^ MZ header ^ PE 
header 7> ^H^Rr^l ^A>^ ^ofl ^^fl ^3 5}^ sRr ^ ^S. 

7 r 5}-^ ^1 

[^^J- 7] 

A oM *<H^ ^4, #71 ^AVtfl^^ofl *2*J s)-^ 5L^? MZ header ^ PE 
header 7> ^fl^Rr ^-*M(fe- ^7} ^V^tf^-i- ^ i22=# i^tb sf^S ^ 

[^T 1 * 8] 

*Rr ^1^^SZL^# 3^*Hr 2-1^]; 

A o v 7l *1^3.zz.e»_0 3. ^-71 ^A}^^^ 2-2^1; ^ 

A o V 7l ^llHiH^ -g^olM AflS.^ ^4^7} ^5)^*1 £l^E^5}b 

2-3^3:741 
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9] 

^°l*Hir 3-l#7fl ; 

HS^^ol oi^^l ^Afl^ 3-2^7j] ; £ 

A ^7l 3^3}-, a o V 7 1 ^ H^l^ DB^l #7l Afl^ ^S.^^o] 

10] 

-^2. ££a|a 7 } ^a 0 v s^]^ DB°ll ES^liS. ^r^]-^ <#7] 
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[3^8- HI 

<#7) 3=7]- ^7^^1 S}- ^ ^1 #7] 3&7\M*\ <#7] *ftS.-§: S. 

1- Cl 3E#*H 3* ^^SLS- ^ 3JEL7} #7^ 3^ 

*1 
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